A protected route is a client page accessible only if the user is logged in: a guard component redirects to the login page otherwise. This check improves the experience but secures nothing: the real protection is the API's, which must refuse unauthorized requests.
Example
if (!user) return <Navigate to="/login" replace />;